pub-9230e46666a547d396d822bb36f78df3.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Show response pub-9230e46666a547d396d822bb36f78df3.r2.dev/	1 KB 1 KB	753ms 410ms	Document application/xhtml+xml	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5139caeffcbe3b29c3d56e3bab3e27f24bf82b3a0de01b31aad03a5b5d532532 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 accept-language en-US,en;q=0.9 Response headers CF-RAY 826bdceb88ae4bc6-BUF Connection keep-alive Content-Encoding gzip Content-Type application/xhtml+xml Date Thu, 16 Nov 2023 01:11:58 GMT ETag W/"247d20fd8fa437870c022677982ff3c8" Last-Modified Sun, 15 Oct 2023 19:07:17 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.9.1/	90 KB 33 KB	269ms 34ms	Script text/javascript	2607:f8b0:4004:c1b::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Requested by Host: pub-9230e46666a547d396d822bb36f78df3.r2.dev URL: https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers date Wed, 15 Nov 2023 08:04:11 GMT content-encoding gzip x-content-type-options nosniff age 61667 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33018 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 14 Nov 2024 08:04:11 GMT
GET H/1.1	200 OK	blocked.js Show response pub-9230e46666a547d396d822bb36f78df3.r2.dev/	53 KB 12 KB	187ms 186ms	Script text/javascript	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/blocked.js?hijiji=dGVzdEBtYWlsLmNvbQ-- Requested by Host: pub-9230e46666a547d396d822bb36f78df3.r2.dev URL: https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bea789f658aa22798c9dc86f9aede946ccdd81813b7f52e095b8bed19c8fd662 Request headers accept-language en-US,en;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Date Thu, 16 Nov 2023 01:11:58 GMT Content-Encoding gzip Last-Modified Sat, 04 Nov 2023 13:41:13 GMT Server cloudflare ETag W/"2b706df9fbf55d1c9c6a0745b2292025" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 826bdcf058ed4bc6-BUF
POST H2	200	index.php Show response dev-administator.pantheonsite.io//wp/	312 B 662 B	3457ms 3218ms	XHR text/html	2620:12a:8001::3
General Check archive.org Show headers Download Go to Full URL https://dev-administator.pantheonsite.io//wp/index.php Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:12a:8001::3 -, , ASN (), Reverse DNS Software nginx / Resource Hash dc39f4314da5a76a84b1c69726623afe2b62c3318ace2d031135ead142119981 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Accept */* Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers expires Thu, 19 Nov 1981 08:52:00 GMT strict-transport-security max-age=300 content-encoding gzip via 1.1 varnish, 1.1 varnish date Thu, 16 Nov 2023 01:12:02 GMT age 0 x-cache MISS, MISS x-pantheon-styx-hostname styx-fe3-a-7f78b7f579-jj9n9 content-length 166 x-served-by cache-chi-kigq8000043-CHI, cache-ewr18122-EWR pragma no-cache server nginx x-timer S1700097119.225930,VS0,VE3111 vary Accept-Encoding, Cookie, Cookie content-type text/html; charset=UTF-8 access-control-allow-origin * x-styx-req-id 24483cec-841d-11ee-8d1b-1e298109fb90 cache-control no-store, no-cache, must-revalidate accept-ranges bytes x-robots-tag noindex x-cache-hits 0, 0
GET DATA	200 OK	truncated /	3 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a32558a8e67bd48e551fb110df2607d396d314c296e277a76d32e0fcce3624af Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	download_35.jpeg nuyduhop.uber.space/api/pics/	277 KB 277 KB	1489ms 218ms	Image image/jpeg	2001:1a50:11:0:74ea:6ff:fe36:155
General Check archive.org Show headers Download Go to Show image Full URL https://nuyduhop.uber.space/api/pics/download_35.jpeg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1a50:11:0:74ea:6ff:fe36:155 -, , ASN (), Reverse DNS Software nginx / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers date Thu, 16 Nov 2023 01:12:03 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin last-modified Wed, 04 Oct 2023 16:06:38 GMT server nginx etag "452d7-606e6313abcc5" x-frame-options SAMEORIGIN content-type image/jpeg accept-ranges bytes content-length 283351 x-xss-protection 1; mode=block
GET H2	200	download02.png nuyduhop.uber.space/api/pics/	1 KB 1 KB	1597ms 326ms	Image image/png	2001:1a50:11:0:74ea:6ff:fe36:155
General Check archive.org Show headers Download Go to Show image Full URL https://nuyduhop.uber.space/api/pics/download02.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1a50:11:0:74ea:6ff:fe36:155 -, , ASN (), Reverse DNS Software nginx / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers date Thu, 16 Nov 2023 01:12:03 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin last-modified Wed, 04 Oct 2023 16:06:30 GMT server nginx etag "421-606e630c1291d" x-frame-options SAMEORIGIN content-type image/png accept-ranges bytes content-length 1057 x-xss-protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery string| result function| importScript function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
dev-administator.pantheonsite.io
nuyduhop.uber.space
pub-9230e46666a547d396d822bb36f78df3.r2.dev
2001:1a50:11:0:74ea:6ff:fe36:155
2606:4700::6812:223
2607:f8b0:4004:c1b::5f
2620:12a:8001::3
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
5139caeffcbe3b29c3d56e3bab3e27f24bf82b3a0de01b31aad03a5b5d532532
a32558a8e67bd48e551fb110df2607d396d314c296e277a76d32e0fcce3624af
bea789f658aa22798c9dc86f9aede946ccdd81813b7f52e095b8bed19c8fd662
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
dc39f4314da5a76a84b1c69726623afe2b62c3318ace2d031135ead142119981
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c